Facebook may only process the personal data of German WhatsApp users where these users have provided their prior consent in compliance with German data protection law.
A decision issued by the Hamburg Administrative Court states that the consent declaration currently used in WhatsApp does not meet these requirements (Hamburg Administrative Court, April 24, 2017, 13 E 5912/16
The court therefore declined to temporarily stay the prohibition order of Hamburg’s Commissioner for Data Protection and Freedom of Information. In September 2016, he prohibited Facebook to process personal data of German WhatsApp users without obtaining effective and informed user consent. In the administrative appeal proceedings, no decision has been made yet.Practical tip:
Since the decision involved interim relief proceedings, the court could leave open the questions of whether data processing by Facebook must at all meet the requirements of German data protection law and whether German data protection authorities are responsible for orders against Facebook. Neither question has been definitively resolved by the courts to date.